March 13, 2019 By David Bisson 2 min read

Security researchers discovered an attack campaign targeting Japanese users with a new variant of Ursnif banking malware.

First observed in the beginning of 2019, Cybereason reported that the campaign begins with a phishing email that attempts to trick unsuspecting Japanese users into enabling a weaponized Microsoft Office document’s embedded macros. This results in the execution of several PowerShell commands that, in turn, download an image file. The image uses steganography to hide Bebloh, malware that ultimately pulls down Ursnif’s loader from the attacker’s command-and-control (C&C) server.

The campaign’s final payload differs from previous variants in that it:

  • Creates “last-minute persistence” the moment before an infected system shuts down and injects its core dynamic link library (DLL) into explorer.exe once the machine reboots;
  • Comes with updated modules for stealing credentials from Outlook, Mozilla Thunderbird and Internet Explorer;
  • Has a new module that enables it to steal from cryptocurrency wallets and disk encryption software; and
  • Uses yet another module to evade PhishWall, a Japanese security product.

A Busy Few Months for Ursnif

This isn’t the first time cyberattackers have targeted Japanese users with Bebloh and Ursnif. In August 2018, for instance, Trend Micro detected a campaign in which threat actors used the Cutwail botnet and abused internet query files to distribute the threats. Just two months later, Trend Micro analyzed a similar operation spreading both types of malware.

Ursnif has also been busy without Bebloh. For example, Carbon Black reported on an attack campaign on Jan. 24 in which malicious actors used macros and a PowerShell script to download the malware along with GandCrab ransomware. That same day, Cisco Talos uncovered a fileless operation involving Ursnif. Then, the following month, Bromium detected a sample of the malware hidden within an image of Mario, the popular Nintendo character.

How to Detect Banking Malware Campaigns

Security professionals can defend against campaigns that spread Ursnif and other banking malware by using ahead-of-threat detection to analyze the WHOIS information of potential phishing sites. Organizations should also make use of analytics tools such as VBA editor to inspect the macro code in suspicious Office documents.

More from

Autonomous security for cloud in AWS: Harnessing the power of AI for a secure future

3 min read - As the digital world evolves, businesses increasingly rely on cloud solutions to store data, run operations and manage applications. However, with this growth comes the challenge of ensuring that cloud environments remain secure and compliant with ever-changing regulations. This is where the idea of autonomous security for cloud (ASC) comes into play.Security and compliance aren't just technical buzzwords; they are crucial for businesses of all sizes. With data breaches and cyber threats on the rise, having systems that ensure your…

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

6 Principles of Operational Technology Cybersecurity released by joint NSA initiative

4 min read - Today’s critical infrastructure organizations rely on operational technology (OT) to help control and manage the systems and processes required to keep critical services to the public running. However, due to the highly integrated nature of OT deployments, cybersecurity has become a primary concern.On October 2, 2024, the NSA (National Security Agency) released a new CSI titled “Principles of Operational Technology Cybersecurity.” This new guide was created in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD SCSC) to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today